1. Notification.

1. In the event of any accidental, unauthorized or unlawful access, acquisition, theft, destruction, or disclosure of Customer Data (i.e., any data relating to Platform Science or Customers (or their End Users or vehicles) that is provided or otherwise made available to Developer by Platform Science, through the Platform Science Platform, or which is otherwise obtained or accessed by Developer in connection with Developer’s service to the Platform Science Customer) that occurs while such Customer Data is in the possession of or under the control of Developer or its vendors or agents (“Data Security Incident”), Developer shall respond in accordance with the following:

2. Developer shall notify Platform Science within forty-eight (48) hours of becoming aware of a Data Security Incident. Developer shall provide Platform Science with a detailed description of the Data Security Incident, the type of data that was the subject of the Data Security Incident and, to the extent known to Developer, the identity of each affected person, as soon as this information can be collected or otherwise becomes available, as well as all other information and cooperation that Platform Science may request. The Parties shall cooperate in determining whether notification to affected individuals and/or government authorities is required under applicable Data Protection Laws. If notification is required, Developer shall pay all costs of such notifications.

2. Mitigation.

3. Developer agrees to take action immediately, at its own expense, to investigate the Data Security Incident and to identify, prevent, and mitigate the effects of the Data Security Incident and, with Platform Science’s prior written agreement, to carry out any recovery or other action necessary to remedy the Data Security Incident. Developer shall inform Platform Science of the steps it is taking to mitigate the effects of the Data Security Incident and to minimize the chances of another Data Security Incident happening again.

3. Publicity.

4. Except as explicitly required by Data Protection Laws, Developer shall not issue, publish or make available to any third party any press release or other communication concerning the Data Security Incident without Platform Science’s prior written approval or request.

4. Cooperation.

5. Developer shall provide full cooperation and assistance to Platform Science to enable Platform Science to fulfill its obligations to enable Data Subjects affected by the Data Security Incident to exercise their rights under the Data Protection Laws. Developer shall notify Platform Science within three (3) business days of all communications Developer receives from an affected Data Subject seeking to exercise their right in connection with the Data Security Incident.